@hyper.authio/client 0.0.0-stage → 0.1.1

package/dist/index.cjs

@@ -0,0 +1,1289 @@
+'use strict';
+
+var jose = require('jose');
+
+// src/constants.ts
+var AuthioClaimTypes = {
+  Subject: "sub",
+  JwtId: "jti",
+  Issuer: "iss",
+  Audience: "aud",
+  Expiration: "exp",
+  IssuedAt: "iat",
+  NotBefore: "nbf",
+  AuthTime: "auth_time",
+  TokenType: "typ",
+  AuthorizedParty: "azp",
+  Scope: "scope",
+  SessionId: "sid",
+  AuthenticationContextClass: "acr",
+  AuthenticationMethods: "amr",
+  IdentityProvider: "idp",
+  Nonce: "nonce",
+  OrganizationId: "org_id",
+  OrganizationAlias: "org_alias",
+  AccountId: "account_id",
+  Actor: "act",
+  DelegationId: "delegation_id",
+  ClientId: "client_id",
+  Name: "name",
+  GivenName: "given_name",
+  FamilyName: "family_name",
+  UniqueName: "unique_name",
+  PreferredUsername: "preferred_username",
+  UpdatedAt: "updated_at",
+  Email: "email",
+  EmailVerified: "email_verified",
+  PhoneNumber: "phone_number",
+  PhoneNumberVerified: "phone_number_verified",
+  ConsumerName: "consumer_name",
+  CredentialId: "credential_id",
+  CredentialType: "credential_type",
+  UserResourceAccess: "user_resource_access",
+  RealmResourceAccess: "realm_resource_access",
+  ClientResourceAccess: "client_resource_access",
+  PlanResourceAccess: "plan_resource_access",
+  ConsumerResourceAccess: "consumer_resource_access",
+  SecretResourceAccess: "secret_resource_access",
+  SystemResourceAccess: "system_resource_access"
+};
+var AuthioResourceAccessClaims = Object.freeze({
+  [AuthioClaimTypes.UserResourceAccess]: "user",
+  [AuthioClaimTypes.RealmResourceAccess]: "realm",
+  [AuthioClaimTypes.ClientResourceAccess]: "client",
+  [AuthioClaimTypes.PlanResourceAccess]: "plan",
+  [AuthioClaimTypes.ConsumerResourceAccess]: "consumer",
+  [AuthioClaimTypes.SecretResourceAccess]: "secret",
+  [AuthioClaimTypes.SystemResourceAccess]: "system"
+});
+var AuthioScopes = {
+  OpenId: "openid",
+  Profile: "profile",
+  Email: "email",
+  Phone: "phone",
+  Roles: "roles",
+  OfflineAccess: "offline_access"
+};
+var AuthioGrantTypes = {
+  AuthorizationCode: "authorization_code",
+  RefreshToken: "refresh_token",
+  ClientCredentials: "client_credentials",
+  Password: "password",
+  DeviceCode: "urn:ietf:params:oauth:grant-type:device_code",
+  TokenExchange: "urn:ietf:params:oauth:grant-type:token-exchange",
+  PersonalAccessToken: "personal_access_token"
+};
+var AuthioTokenTypes = {
+  AccessTokenUrn: "urn:ietf:params:oauth:token-type:access_token",
+  ConnectionAccessTokenUrn: "urn:authio:params:oauth:token-type:connection-access-token",
+  AccessToken: "access_token",
+  RefreshToken: "refresh_token"
+};
+var AuthioOAuthErrors = {
+  InvalidRequest: "invalid_request",
+  InvalidClient: "invalid_client",
+  InvalidGrant: "invalid_grant",
+  UnauthorizedClient: "unauthorized_client",
+  UnsupportedGrantType: "unsupported_grant_type",
+  InvalidScope: "invalid_scope",
+  InvalidTarget: "invalid_target",
+  AccessDenied: "access_denied",
+  InvalidToken: "invalid_token",
+  AuthorizationPending: "authorization_pending",
+  SlowDown: "slow_down",
+  ExpiredToken: "expired_token",
+  ConnectionRequired: "connection_required",
+  ConnectionSelectionRequired: "connection_selection_required",
+  ConnectionPolicyViolation: "connection_policy_violation",
+  ServerError: "server_error",
+  TemporarilyUnavailable: "temporarily_unavailable"
+};
+var AuthioWebhookEventTypes = {
+  UserCreated: "user_created",
+  UserUpdated: "user_updated",
+  UserDeleted: "user_deleted",
+  LoginSucceeded: "login_succeeded",
+  LoginFailed: "login_failed",
+  UserLockedOut: "user_locked_out",
+  TokenRevoked: "token_revoked",
+  KeysRotated: "keys_rotated",
+  TokenReuseDetected: "token_reuse_detected",
+  AdminResourceCreated: "admin_resource_created",
+  AdminResourceUpdated: "admin_resource_updated",
+  AdminResourceDeleted: "admin_resource_deleted",
+  UserSuspended: "user_suspended",
+  UserSuspensionEnded: "user_suspension_ended",
+  Ping: "ping"
+};
+var AuthioWebhookHeaders = {
+  Signature: "X-Authio-Signature",
+  Event: "X-Authio-Event",
+  EventId: "X-Authio-Event-Id"
+};
+var AuthioAsymmetricAlgorithms = [
+  "RS256",
+  "RS384",
+  "RS512",
+  "PS256",
+  "PS384",
+  "PS512",
+  "ES256",
+  "ES384",
+  "ES512"
+];
+var AuthioDefaults = {
+  DiscoveryPath: "/.well-known/openid-configuration",
+  RedactedValue: "[redacted]",
+  PlatformRealm: "authio",
+  PlatformClientId: "authio",
+  ApiKeyPrefix: "ak_",
+  ClientSecretPrefix: "cs_",
+  PersonalAccessTokenPrefix: "pat_",
+  /** Seconds. */
+  ClientAssertionLifetime: 120,
+  /** Seconds. */
+  MaxClientAssertionLifetime: 3600,
+  /** Seconds. */
+  DeviceInterval: 5,
+  /** Seconds. */
+  DeviceSlowDownIncrement: 5,
+  /** Seconds a token without `expires_in` is assumed to live. */
+  AssumedTokenLifetime: 300,
+  /** Seconds. */
+  DiscoveryCacheDuration: 3600,
+  /** Seconds. */
+  HttpTimeout: 30,
+  /** Seconds. */
+  TokenRefreshSkew: 60,
+  /** Seconds. */
+  WebhookTolerance: 300,
+  /** Smallest RSA key Authio verifies a client assertion from, in bits. */
+  MinimumRsaKeySize: 2048,
+  CredentialHeaders: ["authorization", "proxy-authorization", "x-api-key", "cookie", "set-cookie"]
+};
+
+// src/errors.ts
+var AuthioError = class extends Error {
+  constructor(message, options) {
+    super(message, options);
+    this.name = new.target.name;
+  }
+};
+var AuthioProtocolError = class extends AuthioError {
+  /** The OAuth error code. */
+  error;
+  /** The OAuth error description. */
+  errorDescription;
+  /** Authio's own error code (`error_code`), more specific than `error`. */
+  errorCode;
+  /** The HTTP status, when the error came from a response. */
+  status;
+  constructor(error, errorDescription, errorCode, status, options) {
+    super(errorDescription ? `${error}: ${errorDescription}` : error, options);
+    this.error = error;
+    this.errorDescription = errorDescription;
+    this.errorCode = errorCode;
+    this.status = status;
+  }
+};
+var AuthioDiscoveryError = class extends AuthioError {
+};
+var AuthioConfigurationError = class extends AuthioError {
+};
+
+// src/options.ts
+var systemClock = {
+  now: () => Date.now(),
+  sleep: (ms, signal) => new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(signal.reason);
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+  })
+};
+function resolveConnection(options) {
+  const requireHttps = options.requireHttps ?? true;
+  const issuer = resolveIssuer(options);
+  for (const [name, value] of [
+    ["authority", options.authority],
+    ["issuer", issuer]
+  ]) {
+    if (value && !isAllowedUrl(value, requireHttps))
+      throw new AuthioConfigurationError(
+        `The Authio ${name} '${value}' must be an absolute HTTPS URL (http is allowed only for loopback, or with requireHttps: false).`
+      );
+  }
+  const fetchImplementation = options.fetch ?? globalThis.fetch;
+  if (typeof fetchImplementation !== "function")
+    throw new AuthioConfigurationError("No fetch implementation is available: pass options.fetch.");
+  return {
+    issuer,
+    discoveryUrl: issuer + AuthioDefaults.DiscoveryPath,
+    requireHttps,
+    discoveryCacheDurationMs: seconds(options.discoveryCacheDuration, AuthioDefaults.DiscoveryCacheDuration, "discoveryCacheDuration"),
+    httpTimeoutMs: seconds(options.httpTimeout, AuthioDefaults.HttpTimeout, "httpTimeout"),
+    fetch: fetchImplementation,
+    clock: options.clock ?? systemClock
+  };
+}
+function resolveIssuer(options) {
+  const issuer = options.issuer?.trim();
+  if (issuer) return trimTrailingSlashes(issuer);
+  const authority = options.authority?.trim();
+  const realm = options.realm?.trim();
+  if (!authority || !realm)
+    throw new AuthioConfigurationError(
+      "The Authio issuer is not set, and authority and realm are not both set to compose it."
+    );
+  return `${trimTrailingSlashes(authority)}/realms/${escapeDataString(realm)}`;
+}
+function isAllowedUrl(value, requireHttps) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return false;
+  }
+  if (url.protocol === "https:") return true;
+  return url.protocol === "http:" && (!requireHttps || isLoopback(url.hostname));
+}
+function escapeDataString(value) {
+  return encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function seconds(value, fallback, name) {
+  const resolved = value ?? fallback;
+  if (!Number.isFinite(resolved) || resolved < 0)
+    throw new AuthioConfigurationError(`The Authio option ${name} must be a non-negative number of seconds.`);
+  return resolved * 1e3;
+}
+function trimTrailingSlashes(value) {
+  return value.replace(/\/+$/, "");
+}
+function isLoopback(hostname) {
+  const host = hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  return host === "localhost" || host === "::1" || /^127(\.\d{1,3}){3}$/.test(host);
+}
+
+// src/http.ts
+function send(connection, url, init, signal) {
+  const timeout = AbortSignal.timeout(connection.httpTimeoutMs);
+  return connection.fetch(url, { ...init, signal: signal ? AbortSignal.any([signal, timeout]) : timeout });
+}
+function formBody(parameters) {
+  const form = new URLSearchParams();
+  for (const [name, value] of Object.entries(parameters)) {
+    if (value !== void 0 && value !== null && value !== "") form.append(name, value);
+  }
+  return form;
+}
+function toScopeString(scopes) {
+  if (scopes === void 0 || scopes === null) return void 0;
+  const values = typeof scopes === "string" ? [scopes] : [...scopes];
+  const distinct = [...new Set(values.flatMap((scope) => (scope ?? "").split(" ").filter(Boolean)))];
+  return distinct.length === 0 ? void 0 : distinct.join(" ");
+}
+async function readProtocolJson(response) {
+  const body = await response.text();
+  if (!response.ok) throw toProtocolError(body, response.status);
+  return parseProtocolJson(body, response.status);
+}
+async function ensureProtocolSuccess(response) {
+  if (response.ok) return;
+  throw toProtocolError(await response.text(), response.status);
+}
+function parseProtocolJson(body, status) {
+  try {
+    const value = JSON.parse(body);
+    if (value === null || typeof value !== "object" || Array.isArray(value)) throw new SyntaxError("The body is not a JSON object.");
+    return value;
+  } catch (error) {
+    throw new AuthioProtocolError(
+      "invalid_response",
+      `Authio answered with a body that could not be read: ${error.message}`,
+      void 0,
+      status,
+      { cause: error }
+    );
+  }
+}
+function toErrorResponse(body) {
+  if (!body?.trim()) return void 0;
+  try {
+    const value = JSON.parse(body);
+    return value && typeof value === "object" && typeof value.error === "string" && value.error ? value : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function toProtocolError(body, status) {
+  const error = toErrorResponse(body);
+  return error ? new AuthioProtocolError(error.error, error.error_description, error.error_code, status) : new AuthioProtocolError(`http_${status}`, `Authio answered HTTP ${status} without an OAuth error.`, void 0, status);
+}
+function redact(value, secrets) {
+  Object.defineProperty(value, /* @__PURE__ */ Symbol.for("nodejs.util.inspect.custom"), {
+    enumerable: false,
+    value() {
+      const copy = {};
+      for (const [name, member] of Object.entries(this))
+        copy[name] = secrets.includes(name) && member !== void 0 && member !== null ? AuthioDefaults.RedactedValue : member;
+      return copy;
+    }
+  });
+  return value;
+}
+
+// src/discovery.ts
+function createAuthioDiscoveryClient(options) {
+  const connection = isConnection(options) ? options : resolveConnection(options);
+  let cached;
+  let pending;
+  const fresh = () => cached && connection.clock.now() - cached.fetchedAt < connection.discoveryCacheDurationMs ? cached.document : void 0;
+  return {
+    connection,
+    async get(signal) {
+      const current = fresh();
+      if (current) return current;
+      pending ??= fetchDocument(connection, signal).then((document) => {
+        cached = { document, fetchedAt: connection.clock.now() };
+        return document;
+      }).finally(() => {
+        pending = void 0;
+      });
+      return pending;
+    },
+    invalidate() {
+      cached = void 0;
+    }
+  };
+}
+function requireEndpoint(document, member) {
+  const value = document[member];
+  if (typeof value !== "string" || !value)
+    throw new AuthioDiscoveryError(`The Authio discovery document has no ${member}.`);
+  return value;
+}
+async function fetchDocument(connection, signal) {
+  const url = connection.discoveryUrl;
+  let body;
+  try {
+    const response = await send(connection, url, { method: "GET", headers: { accept: "application/json" } }, signal);
+    body = await response.text();
+    if (!response.ok) throw new AuthioDiscoveryError(`Authio answered HTTP ${response.status} for the discovery document at ${url}.`);
+  } catch (error) {
+    if (error instanceof AuthioDiscoveryError) throw error;
+    if (signal?.aborted) throw error;
+    const timedOut = error?.name === "TimeoutError";
+    throw new AuthioDiscoveryError(
+      timedOut ? `Reading the Authio discovery document at ${url} timed out.` : `The Authio discovery document at ${url} could not be read.`,
+      { cause: error }
+    );
+  }
+  let document;
+  try {
+    document = JSON.parse(body);
+  } catch (error) {
+    throw new AuthioDiscoveryError(`The Authio discovery document at ${url} is not valid JSON.`, { cause: error });
+  }
+  if (!document || typeof document !== "object" || typeof document.issuer !== "string" || !document.issuer.trim())
+    throw new AuthioDiscoveryError(`The Authio discovery document at ${url} has no issuer.`);
+  if (document.issuer.replace(/\/+$/, "") !== connection.issuer)
+    throw new AuthioDiscoveryError(
+      `The Authio discovery document names the issuer '${document.issuer}', not the configured '${connection.issuer}'.`
+    );
+  return document;
+}
+function isConnection(value) {
+  return typeof value.discoveryUrl === "string" && typeof value.httpTimeoutMs === "number";
+}
+var curveAlgorithms = { "P-256": "ES256", "P-384": "ES384", "P-521": "ES512" };
+async function importSigningKey(input, algorithm, keyId, source) {
+  if (typeof input === "string") {
+    const text = input.trim();
+    if (text.startsWith("{")) return importSigningKey(parseJwk(text, source), algorithm, keyId, source);
+    return importPem(text, algorithm, keyId, source);
+  }
+  if (isCryptoKey(input)) {
+    const shape = describeCryptoKey(input, source);
+    return { key: input, algorithm: settleAlgorithm(shape, algorithm, source), keyId };
+  }
+  return importFromJwk(input, algorithm, keyId ?? (typeof input.kid === "string" ? input.kid : void 0), source);
+}
+var AuthioClientAssertionAlgorithms = AuthioAsymmetricAlgorithms;
+async function importPem(pem, algorithm, keyId, source) {
+  const nodeCrypto = await loadNodeCrypto();
+  if (nodeCrypto) {
+    let keyObject;
+    try {
+      keyObject = nodeCrypto.createPrivateKey({ key: pem, format: "pem" });
+    } catch (error) {
+      throw new AuthioConfigurationError(`${source} could not be read as an RSA or EC private key.`, { cause: error });
+    }
+    const jwk = keyObject.export({ format: "jwk" });
+    return importFromJwk(jwk, algorithm, keyId, source);
+  }
+  if (!pem.includes("-----BEGIN PRIVATE KEY-----"))
+    throw new AuthioConfigurationError(
+      `${source} must be a PKCS#8 PEM ("BEGIN PRIVATE KEY") or a JWK outside Node; PKCS#1 and SEC1 keys need Node.`
+    );
+  const chosen = algorithm?.trim() || "RS256";
+  try {
+    return { key: await jose.importPKCS8(pem, chosen), algorithm: chosen, keyId };
+  } catch (error) {
+    throw new AuthioConfigurationError(`${source} could not be imported for ${chosen}.`, { cause: error });
+  }
+}
+async function importFromJwk(jwk, algorithm, keyId, source) {
+  if (!jwk.d) throw new AuthioConfigurationError(`${source} is a public key; Authio needs the private key to sign.`);
+  const shape = describeJwk(jwk, source);
+  const chosen = settleAlgorithm(shape, algorithm ?? (typeof jwk.alg === "string" ? jwk.alg : void 0), source);
+  try {
+    const key = await jose.importJWK({ ...jwk, alg: chosen }, chosen);
+    return { key, algorithm: chosen, keyId };
+  } catch (error) {
+    throw new AuthioConfigurationError(`${source} could not be imported for ${chosen}.`, { cause: error });
+  }
+}
+function describeJwk(jwk, source) {
+  if (jwk.kty === "RSA") {
+    const bits = base64UrlLength(jwk.n ?? "") * 8;
+    if (bits < AuthioDefaults.MinimumRsaKeySize)
+      throw new AuthioConfigurationError(`${source} is a ${bits}-bit RSA key; use at least ${AuthioDefaults.MinimumRsaKeySize} bits.`);
+    return { type: "RSA" };
+  }
+  if (jwk.kty === "EC") {
+    if (!jwk.crv || !curveAlgorithms[jwk.crv])
+      throw new AuthioConfigurationError(`${source} is an EC key on a curve Authio does not accept; use P-256, P-384 or P-521.`);
+    return { type: "EC", curve: jwk.crv };
+  }
+  throw new AuthioConfigurationError(`${source} could not be read as an RSA or EC private key.`);
+}
+function describeCryptoKey(key, source) {
+  const algorithm = key.algorithm;
+  if (algorithm.name === "ECDSA" && algorithm.namedCurve && curveAlgorithms[algorithm.namedCurve])
+    return { type: "EC", curve: algorithm.namedCurve };
+  if (algorithm.name === "RSASSA-PKCS1-v1_5" || algorithm.name === "RSA-PSS") {
+    if ((algorithm.modulusLength ?? 0) < AuthioDefaults.MinimumRsaKeySize)
+      throw new AuthioConfigurationError(
+        `${source} is a ${algorithm.modulusLength}-bit RSA key; use at least ${AuthioDefaults.MinimumRsaKeySize} bits.`
+      );
+    const size = algorithm.hash?.name.replace("SHA-", "") ?? "256";
+    return { type: "RSA", fixedAlgorithm: `${algorithm.name === "RSA-PSS" ? "PS" : "RS"}${size}` };
+  }
+  throw new AuthioConfigurationError(`${source} is a CryptoKey Authio cannot sign assertions with; use an RSA or EC signing key.`);
+}
+function settleAlgorithm(shape, configured, source) {
+  const suited = shape.fixedAlgorithm !== void 0 ? [shape.fixedAlgorithm] : shape.type === "EC" ? [curveAlgorithms[shape.curve]] : AuthioAsymmetricAlgorithms.filter((name) => name.startsWith("RS") || name.startsWith("PS"));
+  const chosen = configured?.trim() || suited[0];
+  if (!suited.includes(chosen))
+    throw new AuthioConfigurationError(
+      `The signing algorithm '${chosen}' does not suit the key in ${source}; use one of: ${suited.join(", ")}.`
+    );
+  return chosen;
+}
+function parseJwk(text, source) {
+  try {
+    const parsed = JSON.parse(text);
+    if (Array.isArray(parsed.keys)) {
+      if (parsed.keys.length !== 1) throw new Error("A JWK Set must hold exactly one key.");
+      return parsed.keys[0];
+    }
+    return parsed;
+  } catch (error) {
+    throw new AuthioConfigurationError(`${source} is not a valid JWK.`, { cause: error });
+  }
+}
+function base64UrlLength(value) {
+  const clean = value.replace(/=+$/, "");
+  return Math.floor(clean.length * 3 / 4);
+}
+function isCryptoKey(value) {
+  return typeof value === "object" && value !== null && "algorithm" in value && "type" in value && "usages" in value;
+}
+var nodeCryptoModule;
+function loadNodeCrypto() {
+  nodeCryptoModule ??= globalThis.process?.versions?.node ? import('crypto').catch(() => void 0) : Promise.resolve(void 0);
+  return nodeCryptoModule;
+}
+
+// src/client-authentication.ts
+function toBasicAuthorization(clientId, clientSecret) {
+  const bytes = new TextEncoder().encode(`${escapeDataString(clientId)}:${escapeDataString(clientSecret)}`);
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return `Basic ${btoa(binary)}`;
+}
+function createClientAuthenticator(settings, connection) {
+  const clientId = settings.clientId?.trim();
+  if (!clientId) throw new AuthioConfigurationError("The Authio clientId is required.");
+  const hasKey = settings.clientPrivateKey !== void 0 || !!settings.clientPrivateKeyPath;
+  const method = settings.clientAuthentication ?? (!settings.clientSecret && hasKey ? "private_key_jwt" : "client_secret_basic");
+  if ((method === "client_secret_basic" || method === "client_secret_post") && !settings.clientSecret)
+    throw new AuthioConfigurationError(`The Authio clientSecret is required with ${method}.`);
+  if (method === "private_key_jwt" && !hasKey)
+    throw new AuthioConfigurationError("private_key_jwt needs clientPrivateKey or clientPrivateKeyPath.");
+  const lifetimeMs = seconds(settings.clientAssertionLifetime, AuthioDefaults.ClientAssertionLifetime, "clientAssertionLifetime");
+  if (lifetimeMs <= 0 || lifetimeMs > AuthioDefaults.MaxClientAssertionLifetime * 1e3)
+    throw new AuthioConfigurationError(
+      `The Authio clientAssertionLifetime must be more than 0 and at most ${AuthioDefaults.MaxClientAssertionLifetime} seconds.`
+    );
+  const loadKey = method === "private_key_jwt" ? createKeyLoader(settings) : void 0;
+  return {
+    clientId,
+    method,
+    async apply(form, headers) {
+      switch (method) {
+        case "client_secret_basic":
+          headers.set("authorization", toBasicAuthorization(clientId, settings.clientSecret));
+          return;
+        case "client_secret_post":
+          form.set("client_id", clientId);
+          form.set("client_secret", settings.clientSecret);
+          return;
+        case "private_key_jwt":
+          form.set("client_id", clientId);
+          form.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+          form.set("client_assertion", await buildAssertion(clientId, connection, lifetimeMs, await loadKey()));
+          return;
+        default:
+          form.set("client_id", clientId);
+      }
+    }
+  };
+}
+async function buildAssertion(clientId, connection, lifetimeMs, signing) {
+  const now = Math.floor(connection.clock.now() / 1e3);
+  const jti = [...crypto.getRandomValues(new Uint8Array(16))].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+  return new jose.SignJWT({ jti }).setProtectedHeader({ alg: signing.algorithm, typ: "JWT", ...signing.keyId ? { kid: signing.keyId } : {} }).setIssuer(clientId).setSubject(clientId).setAudience(connection.issuer).setIssuedAt(now).setNotBefore(now).setExpirationTime(now + Math.floor(lifetimeMs / 1e3)).sign(signing.key);
+}
+function createKeyLoader(settings) {
+  if (settings.clientPrivateKey !== void 0) {
+    let loaded;
+    return () => {
+      loaded ??= importSigningKey(settings.clientPrivateKey, settings.clientSigningAlgorithm, settings.clientKeyId, "clientPrivateKey");
+      loaded.catch(() => {
+        loaded = void 0;
+      });
+      return loaded;
+    };
+  }
+  const path = settings.clientPrivateKeyPath;
+  let current;
+  return async () => {
+    const nodeCrypto = await loadNodeCrypto();
+    if (!nodeCrypto) throw new AuthioConfigurationError("clientPrivateKeyPath needs Node; pass clientPrivateKey instead.");
+    const { readFile, stat } = await import('fs/promises');
+    let written;
+    try {
+      written = (await stat(path)).mtimeMs;
+    } catch (error) {
+      throw new AuthioConfigurationError(`clientPrivateKeyPath '${path}' could not be read.`, { cause: error });
+    }
+    if (!current || current.written !== written) {
+      const key = readFile(path, "utf8").then(
+        (pem) => importSigningKey(pem, settings.clientSigningAlgorithm, settings.clientKeyId, `clientPrivateKeyPath '${path}'`)
+      );
+      current = { written, key };
+      key.catch(() => {
+        if (current?.key === key) current = void 0;
+      });
+    }
+    return current.key;
+  };
+}
+var AuthioKeyManagementAlgorithms = ["RSA-OAEP", "RSA-OAEP-256"];
+var AuthioContentEncryptionAlgorithms = ["A128CBC-HS256", "A192CBC-HS384", "A256CBC-HS512"];
+var rsaAlgorithmIdentifier = [48, 13, 6, 9, 42, 134, 72, 134, 247, 13, 1, 1, 1, 5, 0];
+function isAuthioTokenEncrypted(token) {
+  return typeof token === "string" && token.split(".").length === 5;
+}
+function createAuthioTokenDecrypter(key, setting = "clientEncryptionKey") {
+  const imported = /* @__PURE__ */ new Map();
+  const importFor = (algorithm) => {
+    let pending = imported.get(algorithm);
+    if (!pending) {
+      pending = importDecryptionKey(key, algorithm, setting);
+      imported.set(algorithm, pending);
+      pending.catch(() => imported.delete(algorithm));
+    }
+    return pending;
+  };
+  return async (token) => {
+    if (!isAuthioTokenEncrypted(token)) return token;
+    if (!key)
+      throw new AuthioError(
+        `Authio encrypted this token to the client's own key; set ${setting} to the private key Authio showed when it generated the pair.`
+      );
+    const { plaintext } = await jose.compactDecrypt(token, (header) => importFor(header.alg), {
+      keyManagementAlgorithms: [...AuthioKeyManagementAlgorithms],
+      contentEncryptionAlgorithms: [...AuthioContentEncryptionAlgorithms]
+    });
+    return new TextDecoder().decode(plaintext);
+  };
+}
+async function importDecryptionKey(key, algorithm, setting) {
+  try {
+    if (typeof key !== "string") return await importPrivateJwk(key, algorithm, setting);
+    const text = key.trim();
+    return text.startsWith("{") ? await importPrivateJwk(JSON.parse(text), algorithm, setting) : await jose.importPKCS8(toPkcs8(text), algorithm);
+  } catch (error) {
+    if (error instanceof AuthioConfigurationError) throw error;
+    throw new AuthioConfigurationError(`${setting} is neither a private JWK nor a PEM private key.`, { cause: error });
+  }
+}
+function importPrivateJwk(jwk, algorithm, setting) {
+  if (!jwk.d) throw new AuthioConfigurationError(`${setting} is a JWK without its private parameters; only the private key decrypts.`);
+  return jose.importJWK({ ...jwk, alg: algorithm, use: "enc", key_ops: void 0 }, algorithm);
+}
+function toPkcs8(pem) {
+  const normalized = pem.replace(/\\n/g, "\n").trim();
+  if (!normalized.includes("BEGIN RSA PRIVATE KEY")) return normalized;
+  const pkcs1 = fromBase64(normalized.replace(/-----[^-]+-----|\s/g, ""));
+  const body = [2, 1, 0, ...rsaAlgorithmIdentifier, 4, ...derLength(pkcs1.length), ...pkcs1];
+  const der = Uint8Array.from([48, ...derLength(body.length), ...body]);
+  const lines = toBase64(der).match(/.{1,64}/g) ?? [];
+  return `-----BEGIN PRIVATE KEY-----
+${lines.join("\n")}
+-----END PRIVATE KEY-----`;
+}
+function derLength(length) {
+  if (length < 128) return [length];
+  const bytes = [];
+  for (let rest = length; rest > 0; rest >>= 8) bytes.unshift(rest & 255);
+  return [128 | bytes.length, ...bytes];
+}
+function fromBase64(text) {
+  return Uint8Array.from(atob(text), (character) => character.charCodeAt(0));
+}
+function toBase64(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary);
+}
+function createAuthioClient(options) {
+  const connection = resolveConnection(options);
+  const discovery = createAuthioDiscoveryClient(connection);
+  const authenticator = createClientAuthenticator(options, connection);
+  const refreshSkewMs = seconds(options.tokenRefreshSkew, AuthioDefaults.TokenRefreshSkew, "tokenRefreshSkew");
+  const decrypt = createAuthioTokenDecrypter(options.clientEncryptionKey);
+  const tokens = createTokenClient(connection, discovery, authenticator);
+  const clientCredentials = createClientCredentialsCache(connection, authenticator.clientId, tokens, refreshSkewMs);
+  return {
+    issuer: connection.issuer,
+    clientId: authenticator.clientId,
+    connection,
+    discovery,
+    tokens,
+    clientCredentials,
+    async introspect(token, callOptions = {}) {
+      requireValue(token, "token");
+      const response = await postForm(
+        connection,
+        discovery,
+        authenticator,
+        "introspection_endpoint",
+        { token, token_type_hint: callOptions.tokenTypeHint },
+        callOptions.signal
+      );
+      return readProtocolJson(response);
+    },
+    async revoke(token, callOptions = {}) {
+      requireValue(token, "token");
+      const response = await postForm(
+        connection,
+        discovery,
+        authenticator,
+        "revocation_endpoint",
+        { token, token_type_hint: callOptions.tokenTypeHint },
+        callOptions.signal
+      );
+      await ensureProtocolSuccess(response);
+    },
+    async userInfo(accessToken, callOptions = {}) {
+      requireValue(accessToken, "accessToken");
+      const document = await discovery.get(callOptions.signal);
+      const response = await send(
+        connection,
+        requireEndpoint(document, "userinfo_endpoint"),
+        { method: "GET", headers: { authorization: `Bearer ${accessToken}`, accept: "application/json, application/jwt" } },
+        callOptions.signal
+      );
+      const mediaType = response.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase();
+      if (response.ok && mediaType === "application/jwt")
+        return readUserInfoJwt((await response.text()).trim(), document, connection, authenticator.clientId, decrypt, response.status);
+      if (!response.ok) {
+        const body = await response.text();
+        const challenge = toErrorResponse(body) ? void 0 : readBearerChallenge(response);
+        throw challenge ? new AuthioProtocolError(challenge.error, challenge.description, void 0, response.status) : toProtocolError(body, response.status);
+      }
+      return readProtocolJson(response);
+    },
+    clientCredentialsFetch(fetchOptions = {}) {
+      const inner = fetchOptions.fetch ?? connection.fetch;
+      const key = { scopes: fetchOptions.scopes, resource: fetchOptions.resource };
+      return async (input, init) => {
+        const request = new Request(input, init);
+        const body = request.body ? await request.arrayBuffer() : void 0;
+        const attempt = async (token2) => {
+          const headers = new Headers(request.headers);
+          headers.set("authorization", `${token2.tokenType} ${token2.accessToken}`);
+          return inner(request.url, { method: request.method, headers, body, signal: request.signal, redirect: request.redirect });
+        };
+        const token = await clientCredentials.getToken({ ...key, signal: request.signal });
+        const response = await attempt(token);
+        if (response.status !== 401) return response;
+        clientCredentials.invalidate({ ...key, accessToken: token.accessToken });
+        return attempt(await clientCredentials.getToken({ ...key, signal: request.signal }));
+      };
+    }
+  };
+}
+function createTokenClient(connection, discovery, authenticator) {
+  const requestToken = async (parameters, signal) => {
+    const response = await postForm(connection, discovery, authenticator, "token_endpoint", parameters, signal);
+    const token = await readProtocolJson(response);
+    return redact(token, ["access_token", "refresh_token", "id_token"]);
+  };
+  const pollDevice = async (authorization, options = {}) => {
+    requireValue(authorization?.device_code, "device_code");
+    let wait = (authorization.interval && authorization.interval > 0 ? authorization.interval : AuthioDefaults.DeviceInterval) * 1e3;
+    const deadline = authorization.expires_in && authorization.expires_in > 0 ? connection.clock.now() + authorization.expires_in * 1e3 : void 0;
+    for (; ; ) {
+      await connection.clock.sleep(wait, options.signal);
+      if (deadline !== void 0 && connection.clock.now() >= deadline)
+        throw new AuthioProtocolError(AuthioOAuthErrors.ExpiredToken, "The device code expired before the user approved it.");
+      try {
+        return await requestToken({ grant_type: AuthioGrantTypes.DeviceCode, device_code: authorization.device_code }, options.signal);
+      } catch (error) {
+        if (!(error instanceof AuthioProtocolError)) throw error;
+        if (error.error === AuthioOAuthErrors.AuthorizationPending) continue;
+        if (error.error === AuthioOAuthErrors.SlowDown) {
+          wait += AuthioDefaults.DeviceSlowDownIncrement * 1e3;
+          continue;
+        }
+        throw error;
+      }
+    }
+  };
+  return {
+    clientCredentials: (options = {}) => requestToken(
+      { grant_type: AuthioGrantTypes.ClientCredentials, scope: toScopeString(options.scopes), resource: options.resource },
+      options.signal
+    ),
+    authorizationCode: (options) => {
+      requireValue(options?.code, "code");
+      requireValue(options.redirectUri, "redirectUri");
+      return requestToken(
+        {
+          grant_type: AuthioGrantTypes.AuthorizationCode,
+          code: options.code,
+          redirect_uri: options.redirectUri,
+          code_verifier: options.codeVerifier,
+          resource: options.resource
+        },
+        options.signal
+      );
+    },
+    refresh: (options) => {
+      requireValue(options?.refreshToken, "refreshToken");
+      return requestToken(
+        { grant_type: AuthioGrantTypes.RefreshToken, refresh_token: options.refreshToken, scope: toScopeString(options.scopes) },
+        options.signal
+      );
+    },
+    exchange: (options) => {
+      requireValue(options?.subjectToken, "subjectToken");
+      return requestToken(
+        {
+          grant_type: AuthioGrantTypes.TokenExchange,
+          subject_token: options.subjectToken,
+          subject_token_type: AuthioTokenTypes.AccessTokenUrn,
+          requested_token_type: AuthioTokenTypes.AccessTokenUrn,
+          scope: toScopeString(options.scopes),
+          resource: options.resource
+        },
+        options.signal
+      );
+    },
+    async exchangeForConnection(options) {
+      requireValue(options?.subjectToken, "subjectToken");
+      requireValue(options.provider, "provider");
+      const response = await postForm(
+        connection,
+        discovery,
+        authenticator,
+        "token_endpoint",
+        {
+          grant_type: AuthioGrantTypes.TokenExchange,
+          subject_token: options.subjectToken,
+          subject_token_type: AuthioTokenTypes.AccessTokenUrn,
+          requested_token_type: AuthioTokenTypes.ConnectionAccessTokenUrn,
+          connection_provider: options.provider,
+          connection_id: options.connectionId
+        },
+        options.signal
+      );
+      return toConnectionExchangeResult(await response.text(), response.status, options.provider);
+    },
+    async deviceAuthorization(options = {}) {
+      const response = await postForm(
+        connection,
+        discovery,
+        authenticator,
+        "device_authorization_endpoint",
+        { scope: toScopeString(options.scopes) },
+        options.signal
+      );
+      return redact(await readProtocolJson(response), ["device_code"]);
+    },
+    pollDevice,
+    password: (options) => {
+      requireValue(options?.username, "username");
+      if (typeof options.password !== "string") throw new TypeError("password is required.");
+      return requestToken(
+        { grant_type: AuthioGrantTypes.Password, username: options.username, password: options.password, scope: toScopeString(options.scopes) },
+        options.signal
+      );
+    }
+  };
+}
+function createClientCredentialsCache(connection, clientId, tokens, refreshSkewMs) {
+  const entries = /* @__PURE__ */ new Map();
+  const pending = /* @__PURE__ */ new Map();
+  const keyOf = (scope, resource) => `${connection.issuer}|${clientId}|${(scope ?? "").split(" ").filter(Boolean).sort().join(" ")}|${resource ?? ""}`;
+  return {
+    async getToken(options = {}) {
+      const scope = toScopeString(options.scopes);
+      const key = keyOf(scope, options.resource);
+      const cached = entries.get(key);
+      if (cached && connection.clock.now() < cached.refreshAt) return cached;
+      let request = pending.get(key);
+      if (!request) {
+        request = tokens.clientCredentials({ scopes: scope, resource: options.resource, signal: options.signal }).then((response) => {
+          const token = toClientCredentialsToken(response, connection.clock.now(), refreshSkewMs);
+          entries.set(key, token);
+          return token;
+        }).finally(() => pending.delete(key));
+        pending.set(key, request);
+      }
+      return request;
+    },
+    invalidate(options = {}) {
+      const key = keyOf(toScopeString(options.scopes), options.resource);
+      if (options.accessToken === void 0 || entries.get(key)?.accessToken === options.accessToken) entries.delete(key);
+    }
+  };
+}
+function toClientCredentialsToken(response, issuedAt, refreshSkewMs) {
+  const lifetime = (response.expires_in && response.expires_in > 0 ? response.expires_in : AuthioDefaults.AssumedTokenLifetime) * 1e3;
+  const expiresAt = issuedAt + lifetime;
+  const skew = Math.min(refreshSkewMs, lifetime / 2);
+  return redact(
+    {
+      accessToken: response.access_token,
+      tokenType: response.token_type?.trim() ? response.token_type : "Bearer",
+      expiresAt,
+      refreshAt: expiresAt - skew,
+      scope: response.scope
+    },
+    ["accessToken"]
+  );
+}
+function toConnectionExchangeResult(body, status, provider) {
+  if (status >= 200 && status < 300) {
+    const token = parseProtocolJson(body, status);
+    if (typeof token.access_token === "string" && token.access_token)
+      return redact(
+        {
+          status: "granted",
+          accessToken: token.access_token,
+          provider: typeof token.provider === "string" && token.provider ? token.provider : provider,
+          providerType: token.provider_type,
+          connectionId: token.connection_id,
+          tokenType: token.token_type,
+          issuedTokenType: token.issued_token_type,
+          scope: token.scope,
+          externalAccount: token.external_account,
+          expiresIn: token.expires_in
+        },
+        ["accessToken"]
+      );
+  }
+  const error = toErrorResponse(body);
+  const description = error?.error_description?.trim() ? error.error_description : `Authio answered HTTP ${status} to the connected-account token exchange.`;
+  switch (error?.error) {
+    case AuthioOAuthErrors.ConnectionRequired:
+      return { status: "required", connectUri: error.connect_uri, description };
+    case AuthioOAuthErrors.ConnectionSelectionRequired:
+      return { status: "selection_required", connections: error.connections ?? [], description };
+    default:
+      return { status: "refused", error: error?.error ?? `http_${status}`, code: error?.error_code, description, connectUri: error?.connect_uri };
+  }
+}
+async function postForm(connection, discovery, authenticator, endpoint, parameters, signal) {
+  const document = await discovery.get(signal);
+  const url = requireEndpoint(document, endpoint);
+  const form = formBody(parameters);
+  const headers = new Headers({ accept: "application/json", "content-type": "application/x-www-form-urlencoded" });
+  await authenticator.apply(form, headers);
+  return send(connection, url, { method: "POST", headers, body: form.toString() }, signal);
+}
+async function readUserInfoJwt(jwt, document, connection, clientId, decrypt, status) {
+  try {
+    const signed = isAuthioTokenEncrypted(jwt) ? await decrypt(jwt) : jwt;
+    const keys = jose.createRemoteJWKSet(new URL(requireEndpoint(document, "jwks_uri")), { [jose.customFetch]: connection.fetch });
+    const { payload } = await jose.jwtVerify(signed, keys, {
+      issuer: document.issuer,
+      audience: clientId,
+      clockTolerance: 30
+    });
+    return payload;
+  } catch (error) {
+    throw new AuthioProtocolError(
+      "invalid_userinfo",
+      `The userinfo JWT could not be verified: ${error?.message ?? "unknown reason."}`,
+      void 0,
+      status,
+      { cause: error }
+    );
+  }
+}
+function readBearerChallenge(response) {
+  const header = response.headers.get("www-authenticate");
+  if (!header || !/^bearer\s/i.test(header.trim())) return void 0;
+  let error = "";
+  let description;
+  for (const match of header.matchAll(/([a-zA-Z_]+)\s*=\s*"((?:[^"\\]|\\.)*)"|([a-zA-Z_]+)\s*=\s*([^,\s]+)/g)) {
+    const name = match[1] ?? match[3];
+    const value = (match[2] ?? match[4] ?? "").replace(/\\(.)/g, "$1");
+    if (name === "error") error = value;
+    else if (name === "error_description") description = value;
+  }
+  return error ? { error, description } : void 0;
+}
+function requireValue(value, name) {
+  if (typeof value !== "string" || !value.trim()) throw new TypeError(`${name} is required.`);
+}
+
+// src/resource-access.ts
+var claimSources = new Map(Object.entries(AuthioResourceAccessClaims).map(([name, source]) => [name.toLowerCase(), source]));
+var AuthioResourceAccess = class _AuthioResourceAccess {
+  /** No role at all. */
+  static empty = new _AuthioResourceAccess([]);
+  /** Every role read, in claim order, one entry per source it came from. */
+  entries;
+  /** Every distinct role name. */
+  roles;
+  /** Resource → every method any role allows on it. */
+  permissions;
+  lookup;
+  constructor(entries) {
+    this.entries = Object.freeze([...entries]);
+    this.roles = Object.freeze(distinctIgnoringCase(this.entries.map((entry) => entry.name)));
+    this.lookup = /* @__PURE__ */ new Map();
+    const permissions = {};
+    const spelling = /* @__PURE__ */ new Map();
+    for (const entry of this.entries) {
+      for (const [resource, methods] of Object.entries(entry.permissions)) {
+        const resourceKey = resource.toLowerCase();
+        let allowed = this.lookup.get(resourceKey);
+        if (!allowed) {
+          allowed = /* @__PURE__ */ new Map();
+          this.lookup.set(resourceKey, allowed);
+          spelling.set(resourceKey, resource);
+          permissions[resource] = [];
+        }
+        for (const method of methods) {
+          const methodKey = method.toLowerCase();
+          if (allowed.has(methodKey)) continue;
+          allowed.set(methodKey, method);
+          permissions[spelling.get(resourceKey)].push(method);
+        }
+      }
+    }
+    this.permissions = Object.freeze(Object.fromEntries(Object.entries(permissions).map(([name, methods]) => [name, Object.freeze(methods)])));
+  }
+  /** Whether no role was read. */
+  get isEmpty() {
+    return this.entries.length === 0;
+  }
+  /**
+   * Whether the token holds the role, from any source or only from the given ones.
+   */
+  hasRole(role, sources) {
+    if (!role) return false;
+    const wanted = role.toLowerCase();
+    return this.entries.some((entry) => inSources(entry, sources) && entry.name.toLowerCase() === wanted);
+  }
+  /**
+   * Authio's grant rule: whether any role (from any source, or only from the given ones) allows `method` on
+   * `resource`.
+   */
+  grants(resource, method, sources) {
+    if (!resource || !method) return false;
+    if (!sources || sources.length === 0) return this.lookup.get(resource.toLowerCase())?.has(method.toLowerCase()) ?? false;
+    return this.entries.some((entry) => inSources(entry, sources) && entryGrants(entry, resource, method));
+  }
+  /**
+   * The roles that came from one source.
+   */
+  fromSource(source) {
+    return this.entries.filter((entry) => entry.source === source);
+  }
+};
+function resourceAccessSourceOf(claimType) {
+  return claimType ? claimSources.get(claimType.toLowerCase()) : void 0;
+}
+function parseResourceAccess(claims) {
+  const pairs = isIterable(claims) ? claims : Object.entries(claims);
+  const roles = [];
+  for (const [type, value] of pairs) {
+    const source = resourceAccessSourceOf(type);
+    if (source) roles.push(...parseResourceAccessClaim(source, value));
+  }
+  return roles.length === 0 ? AuthioResourceAccess.empty : new AuthioResourceAccess(roles);
+}
+function parseResourceAccessClaim(source, value) {
+  const root = typeof value === "string" ? parseJson(value) : value;
+  if (!isPlainObject(root)) return [];
+  const roles = [];
+  for (const [name, rolePermissions] of Object.entries(root)) {
+    const permissions = readPermissions(rolePermissions);
+    if (!permissions) return [];
+    roles.push(Object.freeze({ source, name, permissions }));
+  }
+  return roles;
+}
+function readPermissions(value) {
+  if (value === null) return Object.freeze({});
+  if (!isPlainObject(value)) return void 0;
+  const read = {};
+  const seen = /* @__PURE__ */ new Set();
+  for (const [resource, methods] of Object.entries(value)) {
+    const key = resource.toLowerCase();
+    if (methods === null) {
+      if (!seen.has(key)) {
+        seen.add(key);
+        read[resource] = Object.freeze([]);
+      }
+      continue;
+    }
+    if (!Array.isArray(methods)) return void 0;
+    const allowed = [];
+    for (const method of methods) {
+      if (typeof method === "string") allowed.push(method);
+      else if (method !== null) return void 0;
+    }
+    if (!seen.has(key)) {
+      seen.add(key);
+      read[resource] = Object.freeze(allowed);
+    }
+  }
+  return Object.freeze(read);
+}
+function entryGrants(entry, resource, method) {
+  const resourceKey = resource.toLowerCase();
+  const methodKey = method.toLowerCase();
+  for (const [name, methods] of Object.entries(entry.permissions)) {
+    if (name.toLowerCase() === resourceKey) return methods.some((allowed) => allowed.toLowerCase() === methodKey);
+  }
+  return false;
+}
+function inSources(entry, sources) {
+  return !sources || sources.length === 0 || sources.includes(entry.source);
+}
+function distinctIgnoringCase(values) {
+  const seen = /* @__PURE__ */ new Set();
+  return values.filter((value) => {
+    const key = value.toLowerCase();
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+}
+function parseJson(text) {
+  if (!text.trim()) return void 0;
+  try {
+    return JSON.parse(text);
+  } catch {
+    return void 0;
+  }
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isIterable(value) {
+  return typeof value === "object" && value !== null && typeof value[Symbol.iterator] === "function";
+}
+
+// src/webhooks.ts
+var encoder = new TextEncoder();
+async function verifyWebhookSignature(signatureHeader, rawBody, secret, options = {}) {
+  if (!secret) throw new TypeError("secret is required.");
+  if (!signatureHeader?.trim())
+    return { valid: false, failure: "missing_signature", reason: "The X-Authio-Signature header is missing." };
+  const parsed = parseSignatureHeader(signatureHeader);
+  if (!parsed)
+    return {
+      valid: false,
+      failure: "malformed_signature",
+      reason: "The X-Authio-Signature header is not of the form t={unixSeconds},v1={hex}."
+    };
+  const signedAt = new Date(parsed.timestamp * 1e3);
+  const expected = await computeSignature(parsed.timestamp, rawBody, secret);
+  let matched = false;
+  for (const signature of parsed.signatures) matched = constantTimeEquals(expected, signature) || matched;
+  if (!matched)
+    return {
+      valid: false,
+      failure: "signature_mismatch",
+      reason: "No v1 signature matches the body: the secret is wrong or the body was altered.",
+      timestamp: signedAt
+    };
+  const tolerance = (options.tolerance ?? AuthioDefaults.WebhookTolerance) * 1e3;
+  const now = options.now ?? Date.now();
+  if (Math.abs(now - signedAt.getTime()) > tolerance)
+    return {
+      valid: false,
+      failure: "timestamp_outside_tolerance",
+      reason: `The signature was made at ${signedAt.toISOString()}, more than ${tolerance / 1e3} seconds from now.`,
+      timestamp: signedAt
+    };
+  return { valid: true, timestamp: signedAt };
+}
+async function computeWebhookSignatureHeader(rawBody, secret, timestamp) {
+  if (!secret) throw new TypeError("secret is required.");
+  const seconds2 = Math.floor((timestamp instanceof Date ? timestamp.getTime() : timestamp) / 1e3);
+  const signature = await computeSignature(seconds2, rawBody, secret);
+  return `t=${seconds2},v1=${[...signature].map((byte) => byte.toString(16).padStart(2, "0")).join("")}`;
+}
+function parseWebhookEvent(rawBody) {
+  const text = typeof rawBody === "string" ? rawBody : new TextDecoder().decode(rawBody);
+  const value = JSON.parse(text);
+  if (!value || typeof value !== "object" || Array.isArray(value)) throw new SyntaxError("The webhook body is empty.");
+  if (typeof value.type !== "string" || !value.type) throw new SyntaxError("The webhook body has no type.");
+  return value;
+}
+function tryParseWebhookEvent(rawBody) {
+  if (rawBody === null || rawBody === void 0) return void 0;
+  try {
+    return parseWebhookEvent(rawBody);
+  } catch {
+    return void 0;
+  }
+}
+function isWebhookEventOfType(event, ...types) {
+  return types.includes(event.type);
+}
+var asUserEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.UserCreated, AuthioWebhookEventTypes.UserUpdated, AuthioWebhookEventTypes.UserDeleted);
+var asLoginEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.LoginSucceeded, AuthioWebhookEventTypes.LoginFailed);
+var asUserLockedOutEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.UserLockedOut);
+var asTokenRevokedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.TokenRevoked);
+var asKeysRotatedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.KeysRotated);
+var asTokenReuseDetectedEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.TokenReuseDetected);
+var asAdminResourceEvent = (event) => dataWhen(
+  event,
+  AuthioWebhookEventTypes.AdminResourceCreated,
+  AuthioWebhookEventTypes.AdminResourceUpdated,
+  AuthioWebhookEventTypes.AdminResourceDeleted
+);
+var asUserSuspensionEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.UserSuspended, AuthioWebhookEventTypes.UserSuspensionEnded);
+var asPingEvent = (event) => dataWhen(event, AuthioWebhookEventTypes.Ping);
+function dataWhen(event, ...types) {
+  return types.includes(event.type) && event.data !== null && event.data !== void 0 ? event.data : void 0;
+}
+function parseSignatureHeader(header) {
+  let timestamp = 0;
+  let timestamps = 0;
+  const signatures = [];
+  for (const raw of header.split(",")) {
+    const part = raw.trim();
+    if (!part) continue;
+    const separator = part.indexOf("=");
+    if (separator <= 0) return void 0;
+    const key = part.slice(0, separator);
+    const value = part.slice(separator + 1);
+    if (key === "t") {
+      timestamps++;
+      if (!/^\d+$/.test(value)) return void 0;
+      timestamp = Number(value);
+    } else if (key === "v1" && value.length === 64 && /^[0-9a-fA-F]+$/.test(value)) {
+      signatures.push(Uint8Array.from(value.match(/../g).map((pair) => parseInt(pair, 16))));
+    }
+  }
+  return timestamps === 1 && signatures.length > 0 && Number.isSafeInteger(timestamp) ? { timestamp, signatures } : void 0;
+}
+async function computeSignature(timestamp, rawBody, secret) {
+  const prefix = encoder.encode(`${timestamp}.`);
+  const body = typeof rawBody === "string" ? encoder.encode(rawBody) : rawBody;
+  const message = new Uint8Array(prefix.length + body.length);
+  message.set(prefix, 0);
+  message.set(body, prefix.length);
+  const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+  return new Uint8Array(await crypto.subtle.sign("HMAC", key, message));
+}
+function constantTimeEquals(left, right) {
+  if (left.length !== right.length) return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index++) difference |= left[index] ^ right[index];
+  return difference === 0;
+}
+
+exports.AuthioAsymmetricAlgorithms = AuthioAsymmetricAlgorithms;
+exports.AuthioClaimTypes = AuthioClaimTypes;
+exports.AuthioClientAssertionAlgorithms = AuthioClientAssertionAlgorithms;
+exports.AuthioConfigurationError = AuthioConfigurationError;
+exports.AuthioContentEncryptionAlgorithms = AuthioContentEncryptionAlgorithms;
+exports.AuthioDefaults = AuthioDefaults;
+exports.AuthioDiscoveryError = AuthioDiscoveryError;
+exports.AuthioError = AuthioError;
+exports.AuthioGrantTypes = AuthioGrantTypes;
+exports.AuthioKeyManagementAlgorithms = AuthioKeyManagementAlgorithms;
+exports.AuthioOAuthErrors = AuthioOAuthErrors;
+exports.AuthioProtocolError = AuthioProtocolError;
+exports.AuthioResourceAccess = AuthioResourceAccess;
+exports.AuthioResourceAccessClaims = AuthioResourceAccessClaims;
+exports.AuthioScopes = AuthioScopes;
+exports.AuthioTokenTypes = AuthioTokenTypes;
+exports.AuthioWebhookEventTypes = AuthioWebhookEventTypes;
+exports.AuthioWebhookHeaders = AuthioWebhookHeaders;
+exports.asAdminResourceEvent = asAdminResourceEvent;
+exports.asKeysRotatedEvent = asKeysRotatedEvent;
+exports.asLoginEvent = asLoginEvent;
+exports.asPingEvent = asPingEvent;
+exports.asTokenReuseDetectedEvent = asTokenReuseDetectedEvent;
+exports.asTokenRevokedEvent = asTokenRevokedEvent;
+exports.asUserEvent = asUserEvent;
+exports.asUserLockedOutEvent = asUserLockedOutEvent;
+exports.asUserSuspensionEvent = asUserSuspensionEvent;
+exports.computeWebhookSignatureHeader = computeWebhookSignatureHeader;
+exports.createAuthioClient = createAuthioClient;
+exports.createAuthioDiscoveryClient = createAuthioDiscoveryClient;
+exports.createAuthioTokenDecrypter = createAuthioTokenDecrypter;
+exports.escapeDataString = escapeDataString;
+exports.isAllowedUrl = isAllowedUrl;
+exports.isAuthioTokenEncrypted = isAuthioTokenEncrypted;
+exports.isWebhookEventOfType = isWebhookEventOfType;
+exports.parseResourceAccess = parseResourceAccess;
+exports.parseResourceAccessClaim = parseResourceAccessClaim;
+exports.parseWebhookEvent = parseWebhookEvent;
+exports.resolveConnection = resolveConnection;
+exports.resolveIssuer = resolveIssuer;
+exports.resourceAccessSourceOf = resourceAccessSourceOf;
+exports.seconds = seconds;
+exports.systemClock = systemClock;
+exports.toBasicAuthorization = toBasicAuthorization;
+exports.toClientCredentialsToken = toClientCredentialsToken;
+exports.toScopeString = toScopeString;
+exports.tryParseWebhookEvent = tryParseWebhookEvent;
+exports.verifyWebhookSignature = verifyWebhookSignature;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map